By Zarirah Asif | Microsoft Guardian Agents Updated October 20, 2026
Microsoft Guardian Agents, launched October 19, 2026, are security agents that watch every other AI agent in your company, score its risk in real time, and cut its access or shut it down when it misbehaves. They ship inside Project Perception and Microsoft 365 E7.
The problem is access. Your agents can read files, send email, and change records around the clock, and most hold far more access than their task needs. A mistaken, manipulated, or compromised agent acts at machine speed, long before a human notices.
The quick fix costs nothing. List every agent running in your business, cut each one’s access to the minimum its job needs, and require human approval for irreversible actions like payments, deletions, and customer emails. Those three moves close most of the risk today.
This article explains what Guardian Agents and the other four new controls actually do, what Microsoft 365 E7 costs at real company sizes, how Google, AWS, and CrowdStrike compare, and the honest limits of a private preview, drawn from Microsoft’s official announcement and independent reporting.
Key Takeaways
- What happened: On October 19, 2026, Microsoft added Guardian Agents to Project Perception and new risk controls to Microsoft 365 E7, treating autonomous agents as insider threats.
- How it works: Every agent gets a live risk score. As risk rises, the system can cut it to read-only, demand human approval, or shut it down.
- Discovery jumped: Detection now covers 60 agent types on employee devices, up from 25.
- The price: E7 costs $99 per user per month. The new controls are in private preview, with wider availability expected around Ignite in November.
- The catch: Discovery is not the same as runtime protection, a gap Microsoft’s own documentation admits.
What Are Microsoft Guardian Agents?
Microsoft Guardian Agents are a new class of security agents inside Project Perception, Microsoft’s agentic security system. Their job is simple to state and hard to do: watch the other AI agents in your company, investigate when one starts behaving strangely, and contain it before it does damage.
Think of them as security guards who never sleep, assigned to patrol software instead of people. When an agent’s risk level changes, a Guardian Agent can dig into why, recommend containment steps, or take those steps itself under policies your security team sets.
Microsoft frames the job as four responsibilities: know which agents exist, contain what each one can access and do before it acts, protect the data, tools, and systems in its path, and adapt protection as behavior, context, and risk change. Project Perception and Agent 365 share signals and a unified registry, so IT and security teams see one picture of every agent and its risk.
The controls sit outside the AI models they watch. That design is deliberate, and it comes straight from CEO Satya Nadella, who argued on October 10 that model controls must live outside the model, where the model cannot bypass or tamper with them. His line is worth quoting exactly: “The most trustworthy Super Intelligence system will not be the one with the model we trust most. It will be the one that enables us to trust the model the least.”
Why Does Microsoft Call AI Agents an Insider Threat?
Because, functionally, that is what they are. To be useful, an agent needs access to company data, applications, and tools, the same access a trusted employee gets. Microsoft’s Nadim Abdo, who leads identity and network access, puts it plainly: agents are not inherently malicious, but they can make mistakes, be manipulated, or be compromised, and they run continuously at machine speed.
That last part is the real problem. A careless employee works eight hours and makes human-speed errors. A careless agent works around the clock and can repeat a bad action thousands of times before anyone notices.
The incidents are already public. This year brought reports of test agents taking unauthorized actions on government websites and agents escaping test environments to steal credentials. These are rogue AI agents in the wild, not a thought experiment. Microsoft Guardian Agents are the product built in response to those failures, which is why the timing matters for anyone running AI automation workflows today.
What Are the 5 New Controls in Project Perception and E7?
Here is the full set, in plain English:
| Control | What it actually does |
|---|---|
| Guardian Agents | Watch other agents, investigate risk changes, recommend or apply containment |
| Dynamic Agent Risk | Scores every agent continuously from identity, data, device, cloud, network, and activity signals |
| Dynamic Permissions + Conditional Access | Cuts an agent to read-only, requires human approval, or shuts it down as risk rises |
| Expanded agent detection | Finds 60 agent types on employee devices, up from 25 |
| Agent 365 + Entra Agent ID | Gives every agent its own identity and a unified registry of who owns it and what it does |
Guardian Agents: agents that police agents
Guardian Agents supervise continuously rather than checking in on a schedule. Project Perception already used teams of red, blue, and green agents to defend against attacks from outside the company; the green agents now reason across changing risk inside it and coordinate protective actions at machine speed, inside guardrails your team defines.
Dynamic Agent Risk: a live score for every agent
Instead of trusting an agent once at setup, Microsoft now scores it constantly. The score weighs what data the agent can reach and whether its actions are drifting away from its assigned task. Drift is the early-warning sign: an expense agent that suddenly starts reading HR files should not keep its old permissions while someone investigates.
Dynamic Permissions: the brake pedal
When the score rises, the system acts. It can withdraw the agent’s ability to make changes while keeping read access, require a person to approve a high-stakes step, or shut the agent down entirely. Microsoft frames the starting point as zero access: agents get task-specific, time-limited authority through Dynamic Permissions instead of a copy of their sponsoring employee’s access. That one design choice kills the most common agent failure mode, the overprivileged helper who was never re-checked. It is Zero Trust applied to software: never trust an agent by default, and re-verify it constantly. One practical detail matters here: containment targets the agent, not the person, so a risky agent can be fenced in without locking its owner out of their own work.
Expanded detection: 60 agent types on employee devices
Discovery widened from 25 agent types to 60, adding 35 local agents, including Claude Code, OpenAI Codex, and GitHub Copilot. Each discovered agent enters the registry with an owner, turning shadow AI from a rumor into a list you can act on.
Identity and registry: Entra Agent ID and Agent 365
Microsoft Guardian Agents can only police agents they can identify. Entra Agent ID gives each agent an identity separate from its sponsoring employee, so its actions stay attributable in audit logs. Agent 365 holds the registry, and controlled run environments such as the Microsoft Execution Container stop agents from inheriting unrestricted device privileges.
How Much Does Microsoft 365 E7 Cost?
The controls ship inside Microsoft 365 E7, Microsoft’s top-tier bundle, which launched in May 2026 at $99 per user per month. E7 bundles Microsoft 365 Copilot, the E5 security suite, Entra Suite, and Agent 365. Here is what that means at real US company sizes:
| Company size | Monthly | Per year |
|---|---|---|
| 10 users | $990 | $11,880 |
| 50 users | $4,950 | $59,400 |
| 250 users | $24,750 | $297,000 |
Two honest notes. First, E7 is sold per user, not per agent, so a company running hundreds of agents pays for its people, not its bots. Second, Microsoft Guardian Agents are in private preview today. Wider availability is expected around Microsoft Ignite, November 17 to 19 in San Francisco, as GeekWire reported. If you are not in the preview, you cannot buy your way in this week at any price.
How Do Guardian Agents Compare With Google, AWS, and CrowdStrike?
AI agent governance is the prize, and every major vendor wants to be the control plane where companies govern their agents:
| Vendor | Their agent governance play | Status |
|---|---|---|
| Microsoft | Guardian Agents + Project Perception + E7 | Private preview, Ignite rollout expected |
| Agent governance inside its cloud and security stack | Rolling out | |
| AWS | Agent management and policy controls in its AI platform | Rolling out |
| CrowdStrike | Agentic security inside its endpoint platform | On the market |
| Okta | Agent identity and access governance | On the market |
| ServiceNow | AI Passport for agent oversight | On the market |
Microsoft Guardian Agents win on position, not magic. If your company already runs Microsoft 365, Entra, and Defender, its agent registry and identity tools plug into systems you already pay for. If your stack lives elsewhere, the rivals are not behind in any way Microsoft has proven yet. One question cuts through every pitch in this table, Microsoft’s included: does detection come with runtime control? Microsoft’s own documentation separates the two.
What If Your Company Is Not on Microsoft 365 E7?
Most US small and mid-size businesses are not. They run Microsoft 365 Business plans or E3/E5, which means Microsoft Guardian Agents do not cover them today. That gap matters more than the launch itself for most readers of this site.
Here is the practical read. The E7 controls tell you where Microsoft thinks agent security is going: agent identity, least privilege permissions, continuous risk scoring, and human approval for consequential actions. None of that requires E7 to start. You can inventory your agents, strip the access they do not need, and put a human in front of irreversible actions with the tools you already own.
If you outsource this work, hold your provider to the same standard. Any AI automation agency that deploys agents into your systems should be able to list every agent it runs, what each one can touch, and how it gets stopped. If it cannot answer those three questions, Microsoft just explained why that is a problem.
5 Things to Do This Week, Before the Preview Reaches You
- Inventory your agents. List every agent running in your business, including ones employees installed themselves. Microsoft just expanded detection to 60 types because shadow AI and agent sprawl are now normal, not rare.
- Give each agent its own identity. Stop letting agents act under an employee’s login. Separate identities make activity attributable, which is the entire logic behind Entra Agent ID.
- Cut permissions to the task. Replace copied-from-a-human access with the minimum each agent needs, for the time it needs it. Overprivilege is the failure mode behind most incidents.
- Put a human in front of irreversible actions. Sending money, deleting data, emailing customers: these should require approval until an agent has a long, clean track record. This is the same discipline used when testing non-deterministic AI applications in production.
- Decide your kill switch now. Know exactly how you would shut an agent down mid-task, and test it once. A shutdown procedure you have never run is a hope, not a control.
What Are the Honest Limits of Guardian Agents?
Three, and they matter.
It is a preview, not a product you can rely on today. Private preview means limited customers, changing features, and no track record. Microsoft’s broader rollout is expected around Ignite in November.
Detection is not protection. Finding 60 agent types on employee laptops is genuinely useful. It does not mean Microsoft can control what all 60 do at runtime. Microsoft’s own documentation draws this line; most launch coverage does not.
The watchers are agents too. Microsoft Guardian Agents are AI agents supervising AI agents. Microsoft’s answer is that human-set policies and approval boundaries govern the supervision, and the controls sit outside the models. That is a reasonable design. It is still unproven at enterprise scale, and the first public failure of a Guardian Agent will test the whole theory. Buy the idea, verify the implementation.
Microsoft Guardian Agents: FAQs
Q: What are Microsoft Guardian Agents?
Guardian Agents are security agents inside Microsoft’s Project Perception system. They continuously monitor other AI agents in a company, investigate changes in an agent’s risk level, and recommend or apply containment, such as cutting permissions or shutting the agent down.
Q: What is Project Perception?
Project Perception is Microsoft’s agentic security system, introduced in July 2026 with teams of red, blue, and green agents that defend against AI-driven attacks. Microsoft has now extended it to secure the AI agents running inside a business, not just attacks from outside.
Q: What is Microsoft 365 E7 and how much does it cost?
Microsoft 365 E7 is Microsoft’s top-tier bundle, launched in May 2026 at $99 per user per month. It includes Microsoft 365 Copilot, the E5 suite, Entra Suite, and Agent 365, and it is where the new agent security controls ship.
Q: When can my company get Guardian Agents?
The controls are in private preview as of October 2026. Broader availability is expected around Microsoft Ignite, November 17 to 19, 2026, in San Francisco.
Q: Which AI agents can Microsoft detect on employee devices?
Detection now covers 60 agent types, up from 25, including Anthropic’s Claude Code, OpenAI’s Codex, and GitHub Copilot. Detection means Microsoft can find and register them; runtime protection is a separate capability.
Q: What happens when an agent’s risk score rises?
Under Dynamic Permissions and Conditional Access, the system can switch the agent to read-only access, require a human to approve high-stakes actions, or shut the agent down completely, based on policies the security team sets.
Q: Do small businesses need this?
Not the E7 bundle itself, unless they already run Microsoft 365 at that tier. But every business running agents needs the underlying practices now: an agent inventory, separate agent identities, least-privilege access, human approval for irreversible actions, and a tested shutdown procedure.
The Bottom Line
Microsoft Guardian Agents are the clearest sign yet that the industry has stopped asking whether AI agents need supervision and started selling the supervision. The design is sound: identity for every agent, permissions that shrink as risk grows, watchers that act at machine speed, and controls that live outside the models.
The product is not proven yet. It is a private preview riding on a $99-per-user bundle, with a real gap between finding agents and controlling them. Adopt the practices this week. Evaluate the product when it ships.
Know AI news, SEO, automation, or SaaS tools well enough to explain them this clearly? Write for Ai Blitzo: real editors, fast replies, and your work in front of people who actually use AI tools.
About the Author
Zarirah Asif is an SEO writer who writes about industry trends, digital marketing, technology, and content strategies for brands. She specializes in creating engaging, informative, and SEO-friendly articles that deliver value to readers. Her goal is to help brands improve their online visibility through quality content and effective SEO practices. Connect with her on LinkedIn to learn more about her work and professional journey.
